Multiple scoped npm repositories with different urls about setup-node

[damccorm]

You're on the right track here. Basically, there are 2 options available to you.

(1) Don't use setup-node for auth and just configure your .npmrc file separately. If you do this, I'd recommend not checking in your token and instead scoping in an env variable, so it would be something like //registry.npmjs.org:_authToken=${NODE_AUTH_TOKEN} then you would scope in a token. Note that you can still run setup-node to get the correct version of node installed, you'd just omit the registry input.
(2) If you don't need access to them in the same step, you can run setup-node in between different steps. e.g.

steps:
- uses: actions/checkout@master
- uses: actions/setup-node@v1
  with:
    node-version: '10.x'
    registry-url: 'https://registry.npmjs.org'
- run: npm install
- run: npm publish
  env:
    NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
- uses: actions/setup-node@v1
  with:
    registry-url: 'https://npm.pkg.github.com'
- run: npm publish
  env:
    NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

At least right now we don't support authenticating to multiple registries at once though

[damccorm]

Closing since I think this has been answered, please comment if it should be reopened!